Getting Data In

Use one or two TCP/UDP ports for two different sources of Syslog if I want them in separate sourcetypes

New Member

In my app, I want Syslog from two different sources in two different sourcetypes (since they both are of different types). I have two options for this:
- enable two ports and assign different sourcetypes to both
- collect them on single port and assign different sourcetypes using regex (will require much analysis of logs)

What is the recommended approach ?

Thanks,
Kashyap

0 Karma
1 Solution

Splunk Employee
Splunk Employee

The best practice approach for syslog collection is to send your log data to a syslog server, apply proper policies in syslog server to write to separate files/folder and use a Universal Forwarder on the syslog server to process the log files the splunky way.

Note that if you send syslog to a Splunk listener, you will lose data every time you have to restart Splunk, e.g. to apply configuration changes. Plus, as you are just finding out, you have to have a separate port for each sourcetype, which gets messy quickly.

View solution in original post

0 Karma

Esteemed Legend

Always use distinct (in this case 2) ports. Then you can debug problems from the outside using OS tools, too.
If you are stuck using a single port then you should use this project and help contribute to the auto-sourcetypeing RegEx list:
https://github.com/splunk/splunk-connect-for-syslog/wiki

0 Karma

Splunk Employee
Splunk Employee

The best practice approach for syslog collection is to send your log data to a syslog server, apply proper policies in syslog server to write to separate files/folder and use a Universal Forwarder on the syslog server to process the log files the splunky way.

Note that if you send syslog to a Splunk listener, you will lose data every time you have to restart Splunk, e.g. to apply configuration changes. Plus, as you are just finding out, you have to have a separate port for each sourcetype, which gets messy quickly.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi kashyap2702,
if you can I'd prefer the first.
Bye.
Giuseppe

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!